---
id: TASK-MEDIUM.7
title: Migrate on-demand sidecars from sidecar-manager.ts to Sablier
status: To Do
assignee: []
created_date: '2026-04-16 22:44'
updated_date: '2026-04-16 22:56'
labels: []
dependencies: []
parent_task_id: TASK-MEDIUM
---

## Description

<!-- SECTION:DESCRIPTION:BEGIN -->
docker-compose.sablier-support.yml is currently a no-op placeholder. To activate scale-to-zero for encryptid + encryptid-db:

1. Add sablier labels to encryptid/encryptid-db in sablier-support.yml (copy from docker-compose.sablier-encryptid.yml):
   - sablier.enable=true
   - sablier.group=encryptid
   - traefik.enable=false (on encryptid)

2. Configure Traefik dynamic config to route auth.rspace.online / auth.ridentity.online / encryptid.jeffemmett.com through the Sablier middleware (sablier.group=encryptid).

3. Verify Sablier container (running 45h healthy on Netcup) receives requests and wakes encryptid on demand.

Without step 2, flipping traefik.enable=false on encryptid will break auth immediately. Must sequence: Traefik route first, then compose-up with new labels.

Context: discovered 2026-04-16 while deploying rTasks canvas — .env on Netcup referenced missing docker-compose.sablier-support.yml, causing docker compose failures.
<!-- SECTION:DESCRIPTION:END -->

## Acceptance Criteria
<!-- AC:BEGIN -->
- [ ] #1 Sablier labels present on encryptid services via sablier-support.yml
- [ ] #2 Traefik dynamic config routes encryptid hostnames through Sablier middleware
- [ ] #3 auth.rspace.online returns 200 after container idle timeout + wake
- [ ] #4 Sablier logs show wake events from real requests
<!-- AC:END -->

## Implementation Notes

<!-- SECTION:NOTES:BEGIN -->
Completed 2026-04-16.

Implementation:
- server/sidecar-manager.ts rewritten to call Sablier's /api/strategies/blocking HTTP endpoint instead of Docker Engine API (commit ee251fd → merged 000ee0d)
- Public API (ensureSidecar / markSidecarUsed / isSidecarRunning / startIdleWatcher) unchanged; all server/index.ts callers untouched
- SABLIER_URL defaults to http://sablier:10000; SIDECAR_SESSION_DURATION=5m matches previous idle timeout
- dev-ops/netcup/sablier/docker-compose.yml attaches sablier to rspace-online_rspace-internal (commit dev-ops/1a29e30 → merged d62b70a)

Verification (demo.rspace.online):
- rspace logs show "[sidecar] Lifecycle delegated to Sablier at http://sablier:10000 (ttl 5m)" on startup
- From rspace container: fetch(http://sablier:10000/health) → 200
- Sablier /api/strategies/blocking returns 200 for an existing running container (rspace-db test)

Outstanding:
- The 5 sidecar containers (kicad-mcp, freecad-mcp, blender-worker, scribus-novnc, open-notebook) do not currently exist on Netcup — run `docker compose --profile sidecar create` in /opt/rspace-online to create them before Sablier can wake anything on demand. Ollama is not in the rspace compose at all; sidecar-manager.ts still lists it but ensureSidecar("ollama") will be a no-op on wake until an ollama container is defined somewhere Sablier can see it.
- Docker socket mount at /var/run/docker.sock on rspace container is now unused — can be removed in a follow-up (security hygiene).

[AC GATE] Reverted to 'To Do': 4/4 ACs unchecked
<!-- SECTION:NOTES:END -->